External Exposure Assessment

Start your External Exposure Assessment

Tell us what public-facing system you want reviewed. We’ll confirm the exact boundary and authority before any testing begins.

Fallback contact: send the same non-secret fit check to engage@mail.witnessops.com. Do not send passwords, private keys, API keys, recovery codes, session tokens or other secrets.

Selected offer: External Exposure Assessment

Price: €1,500 paid pilot — one public-facing domain/application

Timing: Within 3 working days after payment, accepted scope, authority, required inputs, and the collection window are confirmed

Start your External Exposure Assessment.

Tell us what public-facing system you want reviewed. We’ll confirm the exact boundary and authority before any testing begins.

Your name (required)

Work email (required)

Company or team (optional)

Public target (required)

Domain, hostname, public IP, API, application, or public cloud endpoint. No credentials or secrets.

Why now? (optional)

Authority to request this review (required)

Related endpoints or exclusions (optional)

Submitting this form begins asynchronous scope acceptance only. Target-facing work starts only after payment, the SOW, authority, fixed scope, required inputs, and the collection window are confirmed.

Email follow-upengage@mail.witnessops.com

Do not send passwords, private keys, API keys, recovery codes, session tokens or other secrets.

Selected situation

A manually reviewed outside-in security review of one authorised public-facing system.

What happens next

01We check the named public domain, your authority, first-party boundary, exclusions, and operator capacity.
02We accept or reject the scope asynchronously. No sales call is required.
03After payment, accepted SOW, authority, required inputs, and the collection window are complete, the three-working-day delivery clock starts.

First message only

Do not submit secrets, credentials, private keys, MFA codes, source exports, full logs, screenshots, customer records, or unrelated production data. Name evidence types only; source materials are handled after scope is agreed.

Commercial scope

€1,500 paid pilot for one public-facing domain or application. Timing, capacity, and evidence handling are confirmed during asynchronous scope acceptance.

No work starts from this form. No proof run or target-facing check starts from this form.

No customer evidence is accepted until scope is agreed.

Typical bundle

✓exposure-map.json
✓findings.json
✓evidence-register.json
✓evidence-manifest.json
✓MANIFEST.sha256

Inspect External Exposure Assessment sample

Boundary kept clear

Controlled external exposure review, not an open-ended penetration test.

No exploitation, credential testing, destructive activity, or persistence.

Not a certification, attestation, completeness claim, or security guarantee.

Need help? Support./Disclosure: Security.

What the External Exposure Assessment delivers

Exposure map

Confirmed public services and assets inside the accepted first-party boundary.

Evidence-linked findings

Prioritised observations with affected targets and inspectable evidence references.

Remediation priorities

Practical fix-now and fix-next recommendations for the reported findings.

Limits and unknowns

What was not tested, not established, stopped, excluded, or left for deeper work.